Knowledge Graph App Segmentation for Zero-Trust Access Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing zero-trust policies are difficult to configure and often rely on wildcard rules, exposing enterprises to potential security risks due to the increased attack surface from unmanaged devices and cloud-based applications, necessitating improved user-to-application policy recommendations.
Innovation Solution
A method and system that utilize a knowledge graph-based approach to generate zero-trust policies by analyzing user and application log data, determining app-segments and user-groups, and providing access policies based on these segments, while continuously monitoring and adjusting policies to meet quality thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If wildcard rules are used to allow access to every user in an enterprise, then ease of operation is improved, but security is worsened due to increased attack surface
Solution Approach 1:
The patent segments applications into groups based on their security requirements and sensitivity levels. By dividing the application landscape into distinct segments, the system can apply differentiated access policies rather than using blanket wildcard rules, thereby reducing the attack surface while maintaining ease of configuration through automated segmentation.
Solution Approach 2:
The system dynamically adjusts access policy parameters based on user roles, application sensitivity, and security requirements. By changing the parameters of access control (from all-or-nothing wildcard rules to granular, context-aware permissions), the system resolves the contradiction between ease of configuration and security.
2Object-affected harmful factors
If zero-trust policies are manually configured with high security, then security is improved, but device complexity and time consumption increase
Solution Approach 1:
The system performs self-service by automatically analyzing application characteristics, user behaviors, and security requirements to generate appropriate zero-trust policies. This automation eliminates the need for manual configuration of complex policies, reducing both the complexity burden and time consumption while maintaining high security standards.
Solution Approach 2:
The system performs preliminary analysis of applications and user patterns before policy deployment. By pre-configuring policies based on anticipated security needs and application characteristics, the system avoids the complexity of manual adjustment and ensures high security from the outset without requiring ongoing complex configuration.
3Reliability
If zero-trust policies are manually configured with high security, then reliability is improved, but loss of time increases due to time-consuming configuration
Solution Approach 1:
The system automatically generates and configures zero-trust policies by analyzing application data, user behaviors, and security requirements. This self-service capability ensures reliable security policies are deployed quickly without manual intervention, resolving the contradiction between reliability and time consumption.
Solution Approach 2:
The system continuously monitors policy effectiveness and user behaviors, using this feedback to refine and adjust policies automatically. This feedback loop ensures high reliability of security policies while minimizing configuration time, as the system learns and adapts rather than requiring manual reconfiguration.
4Object-affected harmful factors
If microsegmentation is applied to application-to-application traffic, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements microsegmentation by dividing network traffic into fine-grained segments based on application identity, user context, and security requirements. This segmentation reduces the attack surface by limiting lateral movement while managing complexity through automated classification and policy assignment rather than manual network configuration.
Data Source
AI summary
Systems and methods include obtaining log data for a plurality of users of an enterprise, wherein the log data relates to usage of a plurality of applications by the plurality of users; analyzing the log data to determine one or more relations between the plurality of users and the plurality of applications; determining one or more app-segments that are groupings of application of the plurality of applications based on the log data and the one or more relations between the plurality of users and the plurality of applications; and providing access policy of the plurality of applications based on the one or more app-segments.